Extracted

• • Target

    123b713c4b633da7d380443daaf0a459_JaffaCakes118

  • Size

    771KB

  • MD5

    123b713c4b633da7d380443daaf0a459

  • SHA1

    3d195ccf4c13c59c09e001bb65e890b7aed6cffa

  • SHA256

    66a27d30bd7d23c23948d0e34da3eb8b687c32ec5cb5ab030c68b8c60a4e1f74

  • SHA512

    c3507e294579fb149dc6439591c4874518c555934562d9cbf6da70189d5d590c8fa10156014719610b9043dc5a53dea3bb1b8062039bc1e2c199d80aac42fb7a

  • SSDEEP

    12288:CfK6n3qGaNHEyC9/oR9gy5FHK7z10PYCHQpeJkoGUkK1uMlSRUpfP1r:CfK6Pp9AR95y5j+kOkKbyUpfPB

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2